For a self-storage operator, rent collection is the business. Every month, tenants call in to pay, miss a payment, dispute a charge, or work out a plan before their unit goes to auction. Voice AI agents can already answer most of those questions, but accepting PCI-compliant payments via voice agent has remained a problem. About six months ago, we quietly turned on something that closes that gap. Since November 2025, Patty — Cubby's voice AI — has been completing PCI-compliant payments on the same call. 

The PCI problem for self-storage operators

Any business that accepts cards is required to comply with PCI DSS (Payment Card Industry Data Security Standard); the global standard for handling cardholder data. It requires strict controls: third-party audits, scoped data access, no retention in logs, and complete isolation from systems that don't need to see it.

For a voice AI, the bar is even higher. LLM-based agents transcribe every word of the call, log conversation context, and pass data between the model and downstream tools; all of which would put cardholder data into scope and the operator out of compliance. That's why, until now, even the most advanced storage agents have stopped short of the payment itself. The typical solution has been to send sms for payment (which Patty is also capable of) transfer to a human, push the tenant to a third-party portal, or handoff to an Interactive Voice Response (IVR) that interrupts the conversation.

The solution: from call to completed payment, in one conversation

When a tenant says they want to pay a balance, set up a payment plan, or update the card on file, Patty switches to a secure capture flow. From the tenant's perspective, nothing changes: same call, same context.

• The tenant enters their card number on their phone keypad. The keystrokes route through compliant Dual-Tone Multi-Frequency (DTMF) infrastructure straight to the operator's existing payment processor.

• No new processor is required. Patty plugs into the gateway the operator already uses.

• Patty is muted from the call audio during the secure step. The voice AI never hears or sees the raw card number. t only receives non-sensitive outcomes like success/failure, last four card digits, or receipt ID.

• Within seconds, Patty returns to confirm: "Your $187 balance is paid in full. Want me to set up auto-pay so this doesn't happen next month?"

How does it work under the hood?

Patty's payment flow is built on the principle of cardholder-data isolation by architecture. The voice AI layer (the part doing the LLM reasoning, the speech synthesis, the call transcription) is deliberately walled off from the moment a card number enters the picture.

• LLMs don't touch sensitive data. During secure capture, Patty's audio is muted from the call and prompts follow a predetermined, server-validated sequence — not LLM-generated turn-taking.

• Agent separated by design. When a tenant types a card number on their phone keypad, those tones are captured and protected by a separate, secure layer. Patty cannot hear, intercept, or pass along that data.

What this means for operators

Past-due collections are the highest-volume conversation in self storage. Most operators spend a meaningful share of their staff hours each month on calls that exist for one of three reasons: a card expired, auto-pay failed, or the tenant is one missed payment away from a lien. Patty resolves those in one call..

• Fewer auctions. When the agent can actually take the payment at the eleventh hour — at 9pm on a Sunday, the day before a scheduled auction; operators avoid the lien process entirely on borderline accounts. The tenant keeps their stuff. The operator keeps a paying customer.

• Less PCI scope on your staff. Today, every employee who can take a card has to be PCI-trained, on a clean workstation, on a scoped phone line. With Patty handling the bulk of inbound payment calls, that scope shrinks dramatically.

• 24/7 resolution. Tenants pay when they're ready; late evenings, weekends, lunch breaks; not when the office happens to be open.

• No infrastructure change. Patty plugs into the payment processor the operator already uses.

Six months in, the architecture has held, the compliance posture is documented, and the calls are getting resolved in the conversation they started in. 

Tenants don't think about PCI scope. They think about whether they can pay their bill before the office closes. Patty makes that the only thing they have to think about and gives operators a way to handle payments at scale without expanding their PCI footprint to do it.